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We provide a security analysis for continuous variable quantum key distribution protocols based 
on the transmission of two-mode squeezed vacuum states measured via homodyne detection. We 
employ a version of the entropic uncertainty relation for smooth entropies to give a lower bound on 
the number of secret bits which can be extracted from a finite number of runs of the protocol. This 
bound is valid under general coherent attacks, and gives rise to keys which are composably secure. 
For comparison, we also give a lower bound valid under the assumption of collective attacks. For 
both scenarios, we find positive key rates using experimental parameters reachable today. 



Quantum key distribution (QKD) is one of the first 
ideas from quantum information theory for turning quan- 
tum paradoxes into applications, see and references 
therein. The task in QKD is to generate a shared key, 
secret from any eavesdropper (Eve), between two distant 
parties (Alice and Bob) using communication over a pub- 
lic quantum channel and an authenticated classical chan- 
nel. Many different implementations of QKD have been 
proposed, each one with individual strengths and weak- 
nesses. Early proposals are based on exchanging qubits, 
and are part of the family of discrete variable (DV) QKD 
protocols. Continuous variable (CV) protocols have later 
been proposed and offer the possibility to use standard 
telecom technologies (see and references therein), in 
particular, they do not require photon counters. 

A generic QKD protocol starts with the distribution of, 
say, N quantum states between the honest parties which 
are then measured according to the rules of the protocol. 
A certain part of the measurement outcomes is then used 
to estimate Eve's information about the remaining data 
from which a key of length I is generated by classical post- 
processing. The goal of a finite-key security analysis is 
to prove that the key is secure against any wiretapping 
strategy of Eve, up to a small failure probability. This 
is in contrast to the study of asymptotic rates in which 
perfect security in the limit for N to infinity is considered. 

Eve's knowledge can be bounded by the probabil- 
ity that she correctly guesses Alice's measurement out- 
comes. This is expressed by the conditional smooth min- 
entropy |3j of the data from which the key is generated 
given Eve's quantum system. This ensures composable 
security i.e., the protocol can securely be combined 
with other composeably secure cryptographic protocols. 
Since the actual state is not known, the smooth min- 
entropy has to be bounded for the worst case compatible 
with the observed measurement data. This is in general a 
hard task and often simplified by additional assumptions 
about the power of the eavesdropper. Instead of allowing 
the most general, coherent attack on the quantum com- 



* Electronic address: If abian. furrer@itp . uni-hannover . del 



munication between Alice and Bob, the eavesdropper is 
often restricted to collective attacks, meaning that ev- 
ery signal is attacked with the same quantum operation. 
Under this assumption, Alice and Bob can employ state 
tomography to bound Eve's information and to ensure 
security. In the case of DV QKD, these security proofs 
can then often be lifted to security proofs against coher- 
ent attacks using the exponential de Finetti theorems [5] 
or the post-selection technique |6J. 

Most security analysis for CV protocols neglect finite- 
key effects and consider asymptotic rates by using the 
Devetak- Winter formula (7] (see |H] for an infinite di- 
mensional version). We are only aware of [5], where 
a first finite-key analysis for specific protocols under 
the assumption of collective Gaussian attacks was pro- 
vided. Security against coherent attacks was consid- 
ered in [10' '11] based on entanglement purification pro- 
tocols, but without a quantitive analysis. The transfer 
of the exponential de Finetti technique to the infinite- 
dimensional setting is very subtle. This is because ex- 
ponential de Finetti theorems do in general not hold in 
infinite-dimensional systems |12| . but only under addi- 
tional assumptions |T3]. It is often argued that, using 
these results, much of the DV theory can be transferred 
to CV systems. Unfortunately, this approach provides 
only pessimistic finite-key rate estimates. 

Recently, a more direct approach to prove DV QKD 
secure against coherent attacks was presented in |14| . 
which is based on an entropic uncertainty relation with 
quantum side information for smooth entropies |15] . This 
uncertainty relation gives a bound on Eve's information 
about Alice's measurement outcomes in terms of the cor- 
relation between Alice and Bob. The relation between 
security in QKD and uncertainty relations has also been 
employed in |,16, .17j . Based on the recent extension of 
the smooth entropy formalism to the infinite-dimensional 
setting [HI HH], it is the objective of this letter to apply 
the above reasoning to an entanglement based CV pro- 
tocol using two-mode squeezed vacuum states measured 
via homodyne detection. 

Security Definition and Key Rates. — A generic QKD 
protocol between two honest parties, Alice (A) and Bob 
(B) either aborts or outputs a key which consists of 
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strings Sa and Sb on Alice's and Bob's side, respectively. 
We denote by E the information which is wiretapped dur- 
ing the run of the protocol by an attack on the quantum 
channel. For CV systems this is modeled on an infinite- 
dimensional Hilbert space. The state of Sa and E can 
be described classical quantum state 

^S^B =51 1^)^*1 '^'^^ . (1) 
s 

where uj% are states on Eve's system. Three requirements 
have to be fulfilled by an ideal protocol: correctness, se- 
crecy and robustness. Correctness is achieved when the 
output on Alice's and Bob's side agree, Sa = Sb- Secrecy 
of a key means that Sa is uniformly distributed and inde- 
pendent of E and thus given by oj^SaE = '''Sa ® <^e, with 
the uniform mixture of keys, and ue an arbitrary 
state on the E system. A protocol is called secure if it is 
both correct and secret. Finally, we call an ideal protocol 
robust if it never aborts when Eve is passive. 

In reality, we can only hope to achieve an almost ideal 
protocol. For small parameters Ec, and an abortion 
probability Pabort, we require that the protocol is Cc- 
correct, i.e. Pr[iS'^ ^ Sb] < fc, and that the protocol is 
Es-secret, i.e. (1 -pabort) inf^ \\\^^SaE - tsa '^(^e\\ < fs- 
Note that a protocol which always aborts is secure. Thus 
we may impose an additional requirement on the robust- 
ness, e.g., Pabort < 1- This security definition also ensures 
that the protocol is secure in the framework of compos- 
able security in which different cryptographic proto- 
cols can be combined without compromising the overall 
security. We note that this is not the case for security 
definitions that require only a small mutual information 
between the eavesdropper and the key |19| . 

The measurement step of a QKD protocol produces a 
pair of raw keys, Xa and Xb, held by Alice and Bob. If 
the protocol does not abort, the secret keys Sa and Sb 
are extracted using classical error correction and privacy 
amplification schemes. We do not discuss the error cor- 
rection scheme here and simply assume that it will leak 
leakEC bits of information about the key to the eaves- 
dropper. The correctness is checked using a hash func- 
tion evaluated on both resulting strings which leads to 
an additional leakage of order 0(log j-) [H]. 

In the privacy amplification step, two-universal hash 
functions are used to compress the raw key to a final 
length of £ bits. Roughly speaking, this reduces Eve's 
knowledge about Alice's key by A^ — ^ bits. Hence, choos- 
ing i sufficiently small ensures that Eve has no informa- 
tion about the resulting bit strings and the key is in- 
dependent of E. Formally, Eve's uncertainty (or lack of 
knowledge) is measured in terms of the probability that 
she can guess Alice's raw key Xa, i.e. the conditional 
min-entropy H^in{XA\E) (see Appendix [A| for a formal 
definition). In particular, the resulting key is e^-secret 

if 

£ < H'^^^{Xa\E)^ - leakEc - 0(log — ) , (2) 



where e oc es/Pahoit- Here, the smooth min-entropy, 
H^^^{Xa\E), is the optimization of the min-entropy over 
states which are e close to ujxaE, where ujxaE denotes 
the joint state prior to the classical post-processing con- 
ditioned on the event that the protocol does not abort. 
We derive lower bounds on this entropy for the following 
protocol. 

The Protocol. — The analysis of coherent and collective 
attacks can widely be treated in parallel. We consider a 
trusted source located in Alice's lab that produces an en- 
tangled state by mixing two squeezed vacuum states on a 
balanced beam splitter. We assume that each beam con- 
sists of only one bosonic mode. Alice sends one beam to 
Bob whereupon both perform a homodyne measurement. 
They choose uniformly at random between two canoni- 
cally conjugated quadrature observables, amplitude and 
phase, such that Alice's and Bob's outcomes are maxi- 
mally correlated whenever their choice agree. In the case 
of collective attacks they additionally perform measure- 
ments to estimate the covariance matrix. We further as- 
sume that the states generated by the source have tensor 
product form and that the probability that Alice mea- 
sures an amplitude or phase quadrature is larger than 
a {h = 1) is bounded by Pa- This is possible since the 
source is trusted and located in Alice's lab. 

After all measurements are performed, the two parties 
reveal their measurement choices. In the case of coherent 
attacks, they discard the data in which they have mea- 
sured different quadratures ending up with a string of 
N measurement results. Then, they divide the continu- 
ous outcome range of the quadrature measurements into 
intervals {—oo, —a-\-S\, {—a-\-5, —a -\- 25], . . . ,{a~6, oo) 
where we assume for simplicity that 2a/ 5 E N. We 
denote the outcome alphabet by A" = {1,2, ...,2a/5}. 
A random sample X^,X^ S X'^ of length k are used 
for parameter estimation, in which they check the qual- 
ity of their correlation by computing the average dis- 
tance d(Xr, Xg^) = i E ti l^Z " ^'bJ where = 
{XX,)U andXg^ = (^g:,)Li. If ) is smaller 

than do they proceed and otherwise they abort the pro- 
tocol. In case the test is passed, they use the remain- 
ing data Xa,Xb G A"" (n = A'' — fc) as the raw key 
and execute the error correction and privacy amplifica- 
tion protocol as discussed in the paragraph before. For 
collective attacks, the strings Xa E A"" and Xb G A" 
are generated as for coherent attacks but the remaining 
data (before the binning) is used to estimate the covari- 
ance matrix. This also includes the one in which Alice 
and Bob measured different quadratures. 

Analysis for Coherent Attacks. — The goal is to bound 
the smooth min-entropy conditioned on the event that 
the protocol does not abort. For that we use an infinite- 
dimensional version of the entropic uncertainty relation 
for smooth entropies with side information jH], combin- 
ing the uncertainty principle for complementary measure- 
ments with monogamy of entanglement. It states that 
Eve's information about the measurement outcomes Xa 
can be bounded by using the the complementary of the 
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measurements and the correlation between Xa and Xb- 
In particular, if Alice and Bob are highly correlated after 
measuring e.g., the phase quadrature, then Eve's knowl- 
edge about the outcome of the amplitude measurement 
is nearly zero, since the observables are maximally com- 
plementary. We measure this correlation strength by the 
smooth max-entropy H^^^{Xa\Xb), which characterizes 
the amount of information Alice has to send Bob to re- 
trieve Xa- This leads to the bound (see Appendix [B| 

H^,,{Xa\E)^ > nlog ^ - Hi,,{XA\XB)^ , (3) 

where c{S) is the overlap of the two conjugated quadra- 
ture measurements on an interval of length 5 which is 
well approximated by c{S) ~ (5^/(27r) for small S. Equa- 
tion ([3| assumes a uniformly random choice of measure- 
ment settings. Since projectors onto intervals (— oo,— a] 
and [a, oo) would lead to a trivial state-independent un- 
certainty relation, the probability of this event has to be 
estimated using pa . In equation [3] this is included in the 
change of the smoothing parameter from e to e' . 

This reduces the problem to upper bounding the 
smooth max-entropy between Xa and Xb , which can be 
done by n-\ogj{d{XA, Xb)), where 7 is a function arising 
from a large deviation consideration (see Appendix [C| . 
Using sampling theory, the quantity d{XA, Xb) can then, 
with high probability, be estimated by d{X'^ , X'^) plus 
a correction /i, which quantifies its statistical deviation 
to d{XA, Xb) and depends onpa, k and n. Since the pro- 
tocol aborts if d{X^, X^) > do, we obtain the following 
formula for the key length: For parameters fc,Pa,5, 
an eg-secret key of length 

^ = "[log ^ - log j{do + /x)] - leakEc - 0(log — ) . 
can be extracted. 



that measurements on different signals commute. Hence, 
the additional reference signal (local oscillator) used by 
Bob for homodyne detection is covered by our security 
analysis. Placing the trusted source in Alice's lab also 
implies that the analysis is not compatible with reverse 
reconciliation. 

We calculate the correlation between Xa and Xb un- 
der the assumption of an identically and independently 
distributed source producing states with an input squeez- 
ing of lldB and antisqueezing of 16dB. Squeezing at this 
level has been realized in an experiment at 1550nm [21). 
Our noise model consists of loss and excess noise, where 
the latter is set to be 1% as it is mainly due to the classi- 
cal data acquisition (see Appendix [d| . The leakage term 
is estimated assuming an error correction efficiency of 
0.95 [22|. In Fig. [T]the resulting key rates £/N are plot- 
ted for different symmetric losses. We have set security 
parameters = Cc = 10~^. The optimization over the 
other free parameters is done numerically for each N. 
Typical values for N = 10^ are k = 10^, a = 52 and 
S ^ 0.01. 

Analysis for Collective Attacks — Under the assump- 
tion of collective attacks, the state between Alice, Bob, 
and Eve has tensor product structure, uJabe' enabling 
statistical estimations of the covariance matrix of ljab- 
However, we do not cover the statistical details here 
and simply introduce confidence sets C^^^ , which ensure 
that whenever the protocol does not abort the covari- 
ance matrix Tab of ujab lies in Cc ^ with probability at 
least 1 — Epe- Hence, we have to give a lower bound on 
the smooth min-entropy H^^^{XA\E)^»n over all states 
with a covariance matrix Tab G C^^^ . The smooth min- 
entropy is evaluated on the classical quantum state ujx^e 
which is obtained from ujab by taking a purification 
luabe E^nd applying the discretized quadrature measure- 
ment on the A system. 
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FIG. 1: Key rate £/N against coherent attacks for an input 
squeezing/antisqueezing of lldB/16dB and additional sym- 
metric losses of 0% (solid line), 4% (dashed line) and 6% 
(dash-dotted line). For the chosen security parameters see 
the main text. 
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FIG. 2: Key rate £/N against collective Gaussian attacks for 
losses of 0% (solid hne), 15% (dashed line), 24% (dash-dotted 
line). Squeezing strength and security parameters are chosen 
as in the case of coherent attacks. 



We assume that the source in Alice's lab is trusted and 
that her measurement device is described by projections 
onto two canonical variables. Note that the measure- 
ment device on Bob's side need not to be trusted, except 



We employ the quantum equipartition property of 
the smooth min-entropy |23| for infinite-dimensional sys- 
tems [H], stating that for large n, H^^^{XA\E)^(s„t 
approaches the conditional von Neumann entropy 
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H{Xa\E)^. More precisely, we have 

H'^,^{Xa\E)^^^ > n ■ H{Xa\E)^ -V^-A, (4) 

where A is a function of e, S and a (see Appendix |e]) . 
Using that the minimum of H{Xa\E)uj over all states 
with a fixed covariance matrix Tab is attained for the 
corresponding Gaussian state uj^^^ (see Appendix [f] and 
|24j). we get the following formula for the key length. 
For parameters k,a,S, an (es+epe)- secret key of length 



n ■ inf H{Xa\E)^t - • A - leakEC - Cl(log ) 



can be extracted assuming collective attacks. 




FIG. 3: Key rate versus losses secure against coherent attacks 
at = 10® (dot-dashed line), collective Gaussian attacks 
at = 10® (dashed line), and the Devetak- Winter rate [7] 
for perfect information reconciliation (solid line). Squeezing 
strength and security parameters are chosen as in the case of 
coherent attacks. 



To evaluate this finite-key bound numerically, we need 
explicit expressions for the confidence sets. For this, we 
use results from [9J, which assume collective Gaussian 
attacks. We computed the key rates £/N in Fig.[2]for the 
same squeezing strength and loss model as in the case of 
coherent attacks. The detailed calculation of H(XA\E)^r 
can be found in AppendixjG] For simplicity, we assumed a 
constant binning of d over the entire outcome range (a — 
oo). In contrast to the case of coherent attacks, reverse 
reconciliation is possible and can increase the key rate 
essentially if asymmetric losses are assumed (which we do 
not discuss here). In Fig. [s] we plotted the key rate for 
coherent and collective Gaussian attacks in dependence 
of the losses, and compare them with the Devetak- Winter 
rate |7l [8] for perfect error correction. 

Discussion and Outlook. — We provided a finite-key se- 
curity analysis for a continuous variable QKD protocol 
and obtain a composable secure positive key rate against 
coherent attacks for experimentally feasible parameters. 
We compare it with key rates computed under the as- 
sumption of collective Gaussian attacks and find that 
they are significantly higher. This is because the applied 
entropic uncertainty relation, Eq. (|3]), is not tight for the 
considered state, which might be improved by a state de- 
pendent version thereof. Our results for collective attacks 



suggest that an extension of the post-selection technique 
to infinite-dimensional systems (see [25J for a proposal) 
is desirable. In order to relax the assumptions in the 
security proof against coherent attacks, it would be in- 
teresting to study the overlap for more realistic models of 
the quadrature measurements, which may include a con- 
tinuum of modes. Moreover, our arguments might also 
be applicable to other CV QKD schemes [26, 27 . 
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Appendix A: Smooth Min- and Max-Entropies 

For the sake of completeness, we give here a formal defi- 
nition of the smooth conditional min- and max-entropies 
and present the basic properties used in the following. 
For a detailed discussion consult e.g. |23| HHi ,29] for 
the finite-dimensional case and [SJ [T5] for the infinite- 
dimensional case. In the following, Ji always denotes 
a separable Hilbert space and S{H) the state space as- 
sociated to H, which consists of all positive semi-definite 
trace class operators on H with trace 1. Furthermore, we 
define 5< {H) to be the set of all non-normalized states, 
that is, positive semi-definite trace class operators with 
trace smaller or equal to 1. We indicate different subsys- 
tems by labels and denote a state on Hab = 'Ha'^T^b by 
loab and its reduced state on Ha simply by ua- Classical 
systems are denoted by X, Y, Z and are described by em- 
bedding the classical degrees of freedom into a Hilbert 
space w.r.t. a fixed orthonormal basis. This allows to 
read the following definitions for quantum as well as clas- 
sical systems. 

Definition 1. For ujab G S<(1-Lab), we define the min- 
entropy of A conditioned on B as 

H^-,in{A\B)^ = sup sup{A € R| loab < 2-^1a®<tb} ■ 
cfBeSiB) 

The min-entropy of a classical-quantum state ujxb 
characterizes the optimal guessing probability of the clas- 
sical variable X given the quantum system B PFj . 

The purified distance between two states w,/? e 
5<('H) is defined [2S] as V{u!,p) = -^/l — F{uj, p) where 

f\u,p) = (trdVaJ^pl) + v/(l-tr[a])(l-tr[p]))' de- 
notes the generalized fidelity. 

Definition 2. ForuiAB € S<{Hab) o,nd e > 0, we define 
the e-smooth min-entropy of A conditioned on B as 



77^i„(A|B)„ =supi7,„i„(A|S) 



(Al) 
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where the supremum is taken over all Coab G S<{'Hab) 
with V{(jJaBtOJab) < £• The e-smooth max-entropy of A 
conditioned on B is defined as 

H^^^^{A\B)^ = -H^^MC)^ . (A2) 

where loabc is an arbitrary purification of ujab- 

One can show that the definition of the smooth max- 
entropy is independent of the choice of the purification. 
As for the min-entropy, we denote the non-smoothed ver- 
sion (e = 0) of the max-entropy simply by H^i^^{A\B)^. 
The smooth max-entropy can also be expressed as the 
optimization of the max-entropy over e-close states, that 
is, 

Hl^^{A\B)^ - inf i/„,,,(A|B)^ , (A3) 

where the infimum is taken over all Coab G S<{'Hab) 
with V{ujABii'AB) < £• These entropies satisfy the data 
processing inequality saying that whenever the system B 
is manipulated with a quantum operation £ : S{'Hb) ^ 
S{'Hc); the entropy can only increase 

Appendix B: Derivation of the Uncertainty Relation 

Let us assume that the protocol parameters a and 5 are 
fixed. For simplicity, we further assume that M :— 2a/ 5 
is in N. In the protocol Alice and Bob both measure 
the projectors of the quadrature measurements on the 
intervals Ii = (— oo,— a -|- 5], I2 = {—a -\- 5,— a + 25], 
Im ~ {ot — (5, 00). Let us denote the corresponding 
outcome alphabet by A" = {1, 2, , M}, which by def- 
inition is of size \X\ — 2a/5. Let us introduce another 
partition of M into intervals {/fcjfcgN of equal length 5 
such that Ik = Ik for k G X\{\,M}. In the following we 
denote the projection onto the interval / of the spectrum 
of the phase and amplitude operator of Alice by Qa{I) 
and Pa(.I)- 

We can assume that they first distribute all the sub- 
systems on which they perform the measurements. Let 
us denote the state shared between Alice, Bob and Eve 
on which they produce the sifted N measurements by 
uja^b^Ej where N denotes the number of subsystems. 
In the parameter estimation step they check that the av- 
erage distance of the random sample of k measurements 
X^^A:f e X'' satisfies 

d(XP^XP^)<do. (Bl) 

Note that this test can be written as a projector n^^'''' 
which only acts non-trivially on the k subsystems used 
in the parameter step. If this condition holds, they pur- 
sue with the protocol otherwise they abort. Let us de- 
note by wa" B" e the quantum state on the remaining n 



subsystems conditioned on the event that the parameter 
estimation test passes. 

Alice chooses now for each subsystem uniform at ran- 
dom between phase and amplitude measurements. This 
can be modeled by introducing a random variable Z" = 
{Zi, Zn) independently and identically distributed ac- 
cording to the uniform distribution, where Zj takes val- 
ues or 1 depending on whether Alice measures phase 
or amplitude in the ith run. Let us denote the uniform 
distribution over = {0, 1}" by u and by {\z'")}z"£Z" 
an orthonormal basis of a Hilbert space. The random 
measurement choice of Alice can now be modeled by in- 
troducing the state 

UJz^A^.B^E^ J2 (B2) 

and the positive operator valued measure (POVM) 
{n^(z") (g) acting on A" and Z", 

where 

C(^") = (8)ni(zr), (B3) 

i 

with ff^(O) = QAih) and ff^(l) = PA{Ii) for i e X. 
Hence, determines whether phase or quadrature is 
measured. Let us denote the post-measurement state ob- 
tained by measuring the state uja^^ ez" by the POVM 
{nfc.(z")(g|z")(z"|} by Here, Xa takes val- 

ues in X'' and denotes the random variable which de- 
scribes the distribution of the keys. Note that all parties 
are assumed to hold a copy of the variable Z since the 
measurement choices have been revealed in the sifting 
phase. Additionally, we introduce a similar POVM for 
the projections onto the spectrum of Alice's phase and 
amplitude measurements onto the intervals {JijigN and 
denote them by 

n:;(^") = (8)nii(z,), (B4) 

i 

where n*^(0) = and n^(l) = Fa(/,) for i e N. 

The corresponding post-measurement state is denoted by 
'^XaB^ez"- Note that here the distribution over Xa can 
take values in N". 

The main idea in the security proof is to apply an 
uncertainty relation with quantum side information for 
the smooth min- and max-entropy |15j . For that, it is 
important that the measurement are maximally comple- 
mentary. In the case of the POVM {nfe"(z") (g) |z")(z"|} 
this is a problem since the projectors of the phase and 
amplitude measurements onto the big intervals Ii for 
i = 1,M almost commute. The idea is now that by 
trusting the source, we can estimate the (purified) dis- 
tance between the states 'j-'xaBEZ^ ^^'^ '^XaBEZ"- ^'-'^ 
the state i^XaBEZ"! '^^^ then obtain a non-trivial un- 
certainty relation since all projectors have only support 
on an interval of length 6. In particular, it follows that 

{Xa\EZ^% > -nlogc-H^,^ [XaIB^Z^^ (B5) 
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where c = supj ^ \\\J Q A{Ii)\J Pa (^j ) 1 1 • The inequahty in 
this form is proven for the finite-dimensional case in [30 
Corollary 7.6]. The generalization to infinite dimensions 
is straightforward by using the techniques from [8 . It 
turns out the the overlap c only depends on the length 
of the intervals and is given by 

where Sn\-,u) denotes the radial prolate spheroidal 
wave function of the first kind (see S'lid references 
therein) . 

In a next step, we estimate the distance between 
'^^aBEZ ^'^^ '^3caBEZ- According to the main text, we 
assume that the source produces a state which is inde- 
pendently and identically for each run. That is, the state 
has tensor product form ujj^n — oj\^ ■ Furthermore, if we 
set Pq = 1 — Pq we have by assumption that the source 
satisfies 



The bound in (B9l can now be used to bound the 



smooth min- and max-entropy by 

H:^i{XA\EZ-)^ > K,,^{Xa\EZ-)^ 

where e = /(pa, n) / ^Ppass- We simply used the Defini- 
tion [2] and the fact that the purified distance can only 
decrease by tracing out a subsystem. In combination 
with the uncertainty relation in ( B5 ) , we arrive at 



H:+:^:{Xa\EZ^^)^ > -nlogciS) - H^^,JXa\B^'Z^% . 

Applying the data processing inequality to the max- 
entropy H^^^^{Xa\B^Z")^ < H^^^{Xa\Xb)^, we ob- 
tain the final uncertainty relation used in Equation (3) 
in the main text. Note that we assumed in the main text 
that is included in E. 



tr 



uJAQA{[-a,a]) 



> 



Pa, 



(B6) 



as well as tr [wa-Pa([— a, a])] > Pa- Let us now define 
A = N\X and for every z" G [0,1]" the projector 



n^(z") 



fl^"(z") 



(B7) 



which corresponds to the event where at least one of the 
quadrature measurements exceeds a. Since 



with ppass = 1 - Pabort, wc obtain for every z" G Z" 



tr WA"n^(z") < ^. (B8) 

'- Ppass 

We can now bound the fidelity for a fixed G by 
J^(^£b"£,'^£b"£) > (1 - tr [u^A'^niiz^)])^ 

> 1 - 2tr L^-n^^l^") 

1 - n" 



where uj^^^b'-e and u^XaB^e 



Ppass 

denote the normalized states 



conditioned on the event z". Since now the fidelity be- 
\aB"EZ" is just the average over 



tween 'jJ'xj^b^ez^ and cj 



z" g Z^, we obtain by the definition of the purified dis- 
tance (see Section [A]) 



where /(pa,n) = ^2{1 - (1 



f{n,Pa) 

•\/Ppass 



(B9) 



Appendix C: Statistical Analysis for Coherent 
Attacks 



The goal is to show that if the protocol does not abort 
and thus, satisfies d{X^^X^) < do, the smooth max- 
entropy in Equation (3) can be bounded by 

Hi^^{XA\XB)^ < n\ogj{do + Mo) , (CI) 



where 



t \* 



and 



iV(fc + l) 



es/4- 2/(p„,n) 



(C2) 

[2f] and 
The proof 

is divided into two steps and follows closely the argu- 
ments in [14J. First we derive a bound on the smooth 
max-entropy, and then we estimate the probability that 



Note that the alphabet X satisfies \X\ 
e' = es/(4ppass) - 2f{pa,n)/y/p^ [|38^ 



d{XA,XB)>d{Xl\XPp 



Proposition 1. Let X be a finite alphabet, P{x, x') a 
probability distribution on X" x X" for some n € N, 
da > and e > 0. If¥ satisfies PTf[d{x,x') > do] < , 
then 



where 



7?^,,(X|X')p<nlog7(do) , 



7(<) = {t+ Vi+t^) (t/[Vl + t^ - 1]) ' 
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Proof. We first note that the smooth max-entropy is ob- 
tained by taking the infimum over non-smooth max- 
entropies of all states which are e-close in purified dis- 
tance (A3 1. Let us define the probability distribution 



( P(x,x') 
{x,x') = < PM'li^y)<do] ' 

I 1 



if d{x, x') < do 
else 



and note that F(P, Q) = Prp[d(x, x') < do]. Hence, it fol- 
lows that 'P(P, Q) = A/Prp[d(a;,a;') > do] < e. Using that 
the 0-Renyi-entropy is bigger than the max-entropy ^20] . 
we obtain 

-f^max (-'^l-'^Op < -f^max {X\X')f^ < Hq{X\X')q . 

The conditional 0-Renyi entropy of the distribution Q is 
then given by [3, Remark 3.1.4] 

Ho{X\X'}q = maxlogl{a; G X" ; Q{x,x') ^ 0}\ 

x' 

n 

<logl{xeZ" ; <ndo}\ . 

i=l 

For any A > we estimate 

n n 

\{x e Z" ; ^ < ndo}\ < ^ exp[A(ndo - ^ \x^\)] 

EZ" i=l 



5 Ado 



1 -e 

By optimizing over A > 0, one finds that \{x e 
; Er=i < ^f^oll < 7(rfo)"- This completes the 
proof. □ 

Now, we have to estimate the probability that 
diXATXB) > d{X^ , X^) + V conditioned on the event 
that the protocol does not abort. Since the probability 
that the protocol passes is Ppass, we find according to 
Bayes' theorem that 

Vx\d(XA,XB) > + 1^1 "pass"] 

< J_p,[diXA,XB) > rf(^r.^B ) + ^] • 

Ppass 

Deriving a bound on PT[d{{XA,XB) > + v] 

is a standard problem from random sampling without 
replacement. We have that X^,X^ S X'' is a ran- 
dom sample of all measurements G . The 



quantity of interest is \xa 



where x\ £ X ? and 



e xi 



For this we denote the population mean 



by dtot = d{X^*,Xg*), the sample mean by dp^ - 
d{X^ , X^), and for the raw key dkey — d{XA, Xb) 
Note that these are related via 



Ndt^ 



nd, 



key 



(C3) 



We consider the runs of the protocol as a probabilistic 
process and treat dtot as a random variable. We first use 
the bound from 132] to obtain 



Pi'Mfcey > a + v\dtot = a] < e 



which is independent of a. Here, we used that the maxi- 



mal value of \x\ — x^b\ given by \X\. Using Eq. (C3l 
we can compute 



Pr[(itof = a] ■ VY[dkey >a + —v\dtot = a] 



< e 



Hence, together with Proposition [T] and the fact that the 
protocol aborts for d{X^^.,X^Q ) > do, we arrive at 



for 



i/^„ (.Y|X'), <nlog7(<i„ + i') 



In the protocol, we have to bound the smooth max- 
entropy for a smoothing parameter e' = e — — 

'2fiPa,n)/y/p^. Since Ppass < 1, we can bound v < fi 
and obtain the bound in Equation (CI I. 



Appendix D: The Error Model 

We consider a symmetric two parameter error model, 
using the loss /ijoss ^'^^ excess noise /ien- The loss is our 
main source of noise and is equivalent to replacing a cer- 
tain amount of signal by vacuum. The excess noise corre- 
sponds to a classical noise added by the data acquisition 
system and can in principle be made arbitrary small by 
using appropriate equipment. Both effects are gaussian 
noise sources and are expressed as action on the covari- 
ance matrix by F ^- (1 - A'loss)^ + (mIoss + A*en)Fvac, 
where Fyac denotes the covariance matrix of the vacuum 
state. 



Appendix E: Asymptotic Equipartition Property 

We use |18l Proposition 8], which states that for e > 
0, n > |log^, and any quantum state ujab for which 
H{A)i^ is finite, we have 



H:^,^iA\B)^^.>n-H{A\B) 



41og(2-5^"""(^l^)- + 25«— (^1^)- + l)Jlog - 
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In our case, we are interested in the classical quantum 
state ujxaE for which H{Xa)u) is finite and the formula 
applies. Let us now simplify the last term in the above 
inequality. Let ujxaEC be an arbitrary purification of 
'^XaE, we ha ve according to the definition of the max- 
entropy (A2) 



A)ui 



where the last inequality is due to the data processing 
inequality (|A5|. Furthermore, we can also use the data 



processing inequality ( A5 1 to bound the max-entropy 
H^!,-^{Xa\E)ui < H^JXa)uj- Using this two estima- 
tions, we obtain 

^ H laiai^ a\E) ^ 



< 25«max(-f^)^ + l 



Hence, we 
H{Xa\E)^ - 



finally arrive 
- V^n • A with 



at > 



A = 4 lo) 



;(2^^— + 1)^ 



log- 



(El) 



which is used in (4) of the main paper. Note that A 
only depends on e and the measurement distribution on 
Alice's side. Since we assume in our setup a known source 
in Alice's lab this can be directly calculated. 



finite-dimensional B systems, we obtain the same re- 
sult for infinite-dimensional Hilbert spaces via the finite- 
dimensional approximation property of the conditional 
von Neumann entropy as shown in [35]. 

We show now that /{ojab) = H{X\E)i^ satisfies the 
properties (i)-(iii) from which the extremality of the 
Gaussian state follows. The properties (i) and (ii) are ob- 
tained in a similar way as in [24 . In order to show prop- 
erty (iii) one takes a purification ujaba' B' e of loaba' b' , 
which is of course also a purification of loab and lua' b' ■ 
The following chain of inequalities for the von Neumann 
entropies 

HiXX\E)^ = H{X\X'E)^ + H{X'\XE)^ 
+ I{X:X'\E)^ 

> H{X\A'B'E) + H{X\ABE) 

holds for finite-dimensional systems due to I{X : 
X'\E)^ > and since X {X') is obtained from AB 
{A'B') via a trace preserving completely positive map. 
But this can be lifted to infinite-dimensions via the finite- 
dimensional approximation property [35j as the entropies 
are all finite. Hence, we obtain the strong superadditivity 

fiuJABA'B') = H{XX\E)^ 

> H{X\A'B'E) + H{X\ABE) 

= f{<^AB) + f{^A'B') ■ 



Appendix F: Gaussian Extremality 



The equality in the case of ujab ® ^a' b' follows from the 
additivity of the von Neumann entropy. 



In the following we show that the infimum 
inii^ H{Xa\E)i^ taken over all states loab with covari- 
ance matrix F is attained for the Gaussian representa- 
tive. Even though the argument is in analogy to [24], we 
give it here for the sake of completeness. See also |33] for 
a similar result. 

The main tool is the result from which classifies 
functions which are optimized by Gaussian states. In 
particular, if one can show that a function /{ujab) is (i) 
lower semi-continuous in trace norm, (ii) invariant under 
local unitary transformations, and (iii) strongly superad- 
ditive, i.e. /{ujabA'B') > f{(^AB) + f{(^A'B') where equal- 
ity holds if UJABA' B' = wab (8) UJA' B' 1 then it follows that 
/{ujab) > /{^ab)- Here, denotes the Gaussian rep- 
resentative of the family of states with same covariance 
matrix F. 

Consider now the function /{coab) = H{X\E)^ where 
i-^ABE is a purification of loab ^^nd ujxbe is obtained 
by applying the measurement used in our protocol on 
the A system. The conditional von Neumann entropy 
is defined in accordance with [35], that is, H{A\B)p = 
H {A) p — H {pabWpa^ Pb) where H{p\\a) denotes the rel- 
ative entropy. In this definition we require that H{A)p 
is finite. Note that the classical alphabet X on which 
(jJx is defined is finite such that H{X)^ is always fi- 
nite and the conditional entropy is well-defined. Be- 
cause < H{X\B)p < H{X)p < \og\X\ holds for any 



Appendix G: Calculation of H{Xa\E) for Discretized 
Measurements 

In order to compute the bound on the key length se- 
cure against collective attacks as given in the main pa- 
per, we have to calculate H{Xa\E)u: for a two mode 
squeezed Gaussian state ujab- For the proper definition 
and the properties of conditional von Neumann entropies 
for infinite-dimensional systems, we refer to |35| . Let 
i-^ABC be a Gaussian purification of ujab with w^; a two 
mode Gaussian state. We first rewrite the entropy as 

H{Xa\E)^ = H{XaE)^ - H{E)^ 

= H{E\Xa)u. + H{Xa)^ - H{AB)^ , 

where we used that ijJabe is pure and therefore H{E) = 
H(AB). Note also that in our case the alphabet X is fi- 
nite. Since ujab is a two mode Gaussian state the entropy 
H{AB)^ is just a function of the symplectic invariants 
and can be calculated [36J. 

For the computation of the other entropies, we as- 
sume for simplicity that the correlations in amplitude 
and phase are symmetric, and do the calculation for 
the amplitude measurement with corresponding opera- 
tor denoted by X. The measurement operators for a 
projection onto the interval 7^, k ^ X, are described 
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by -Efc = l^x{Ik), where ii^ is the spectral measure of 
X. The post-measurement states are then given by 
^ABE = l/pk{EkUJABEEl), where pk = tT[uABEEk]. 
The entropy H{Xa)uj is the Shannon entropy of the clas- 
sical distribution {pk}- 

Let us turn to the estimation of H{E\XA)ij- First, we 
note that 

H{E\XA)u:^Y.Pk^^^^-' ' 
fc 

which reduces the problem to calculate H{E)^k for ev- 
ery k € X. For that we introduce the normalized post 
measurement state ljbe{x) conditioned that Alice mea- 
sures the amplitude x G M. Furthermore, we denote 
by p{x) the probability that Alice measures x. Since 
ojae is a Gaussian state, one can show that uje{x) = 
U(i'(a;))a;_E(0)U(u(a;))''', where U(z;) denotes the Weyl op- 
erator which corresponds to a phase space translation and 
w is a continuous function which depends on V ae- Hence, 
we obtain that i?(i?)tj(a;) = H{E)lj{o) for all x. 

Proposition 2. Let ljab be a two mode squeezed Gaus- 
sian state, luabe o, Gaussian purification, and lj be{x) 
and U!^^ as defined above. Then, it follows that 
H{E)^. > H{E)^(^o) and, thus, H{E\Xa)u. > H{E)^^o)- 

Proof. The proof exploits the concavity of the von Neu- 
mann entropy and the fact that the state lu'^ can be 
approximated in trace class by a finite convex com- 
bination of states lue{x). Note that we can write 
= 1/pfc Jj^ p{x)ujE{x)dx where the integral converges 
weakly. As discussed above we also have the relation 
u}e{x) = \]{v[x))u)E{^)^{'^{x)y . Since U(w) is strongly 
continuous in v, we have x i— >■ lobe{x) and, thus, x i— >■ 
uje{x) are trace class continuous. Hence, we know that 
the Lebesgue integral /^^ p(x)uJE{x)(hi converges even in 



trace norm, and furthermore, it is equal to the Riemann 
integral. So we can approximate oj^ in trace norm via 
step functions 

1 ^' 

where it holds for all / that Ik = U j Jj i the G Jj are 

chosen such that J2f=iPi^j)\Jj\ — Pk, and sup^ — 
for I oo. Furthermore, as uje{x) is a Gaussian 
state, we have that for H = + P|. the expecta- 
tion value tr [cj£;(a:)iJ] is bounded and continuous in 
X, so tr [peH] tr for ^ -J> oo |39]. Using 

that the von Neumann entropy is continuous for se- 
quences of states with finite energy |37j . we find that 
H{E)^k = lim;^oo H{p^e), and thus, 

H{uj%) = lim H{p'e) 

1 

i=i 

The inequality is due to the concavity of the von Neu- 
mann entropy ||37J and the last equality holds because 
H{lue{x)) is independent of x. □ 

Using this proposition we finally get 
H{Xa\E)^ > H{E)^i^o) + H{XAh - H{AB)^ , 

where the right-hand side can be calculated since u)e{Q) 
and UJAB are Gaussian states (see [35]). Note that the 
only dependence on the interval length 5 in this formula 
is due to H[Xa)uj- 
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